CVE-2026-16256

CriticalCVSS 9.8/10Last modified Aug 26, 2026

Description

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
UnknownPOUCO Import Users<= 1.0.0

References

Timeline

Published
Aug 2, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-162578.2The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access contCVE-2026-162589.8The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attacCVE-2026-162599.8The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update CVE-2026-16269.1An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of thCVE-2026-162606.8The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings bCVE-2026-162617.5The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, aCVE-2026-162627.5The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowCVE-2026-162638.8The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a uCVE-2026-162646.5The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues CVE-2026-162656.5The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operatioCVE-2026-162664.0Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attackerCVE-2026-162678.1The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submi
CVE-2026-16256: Critical severity, CVSS 9.8 | Vulnix